| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-44933: bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| bnxt_en : Fix memory out-of-bounds in bnxt_fill_hw_rss_tbl() |
| |
| A recent commit has modified the code in __bnxt_reserve_rings() to |
| set the default RSS indirection table to default only when the number |
| of RX rings is changing. While this works for newer firmware that |
| requires RX ring reservations, it causes the regression on older |
| firmware not requiring RX ring resrvations (BNXT_NEW_RM() returns |
| false). |
| |
| With older firmware, RX ring reservations are not required and so |
| hw_resc->resv_rx_rings is not always set to the proper value. The |
| comparison: |
| |
| if (old_rx_rings != bp->hw_resc.resv_rx_rings) |
| |
| in __bnxt_reserve_rings() may be false even when the RX rings are |
| changing. This will cause __bnxt_reserve_rings() to skip setting |
| the default RSS indirection table to default to match the current |
| number of RX rings. This may later cause bnxt_fill_hw_rss_tbl() to |
| use an out-of-range index. |
| |
| We already have bnxt_check_rss_tbl_no_rmgr() to handle exactly this |
| scenario. We just need to move it up in bnxt_need_reserve_rings() |
| to be called unconditionally when using older firmware. Without the |
| fix, if the TX rings are changing, we'll skip the |
| bnxt_check_rss_tbl_no_rmgr() call and __bnxt_reserve_rings() may also |
| skip the bnxt_set_dflt_rss_indir_tbl() call for the reason explained |
| in the last paragraph. Without setting the default RSS indirection |
| table to default, it causes the regression: |
| |
| BUG: KASAN: slab-out-of-bounds in __bnxt_hwrm_vnic_set_rss+0xb79/0xe40 |
| Read of size 2 at addr ffff8881c5809618 by task ethtool/31525 |
| Call Trace: |
| __bnxt_hwrm_vnic_set_rss+0xb79/0xe40 |
| bnxt_hwrm_vnic_rss_cfg_p5+0xf7/0x460 |
| __bnxt_setup_vnic_p5+0x12e/0x270 |
| __bnxt_open_nic+0x2262/0x2f30 |
| bnxt_open_nic+0x5d/0xf0 |
| ethnl_set_channels+0x5d4/0xb30 |
| ethnl_default_set_doit+0x2f1/0x620 |
| |
| The Linux kernel CVE team has assigned CVE-2024-44933 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.10.4 with commit bc57f879a420d19bb5ecdb480f858371554f2258 and fixed in 6.10.5 with commit abd573e9ad2ba64eaa6418a5f4eec819de28f205 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-44933 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/net/ethernet/broadcom/bnxt/bnxt.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/abd573e9ad2ba64eaa6418a5f4eec819de28f205 |
| https://git.kernel.org/stable/c/da03f5d1b2c319a2b74fe76edeadcd8fa5f44376 |
